@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies

CRITICAL 9.8CVE-2026-82860 · GHSA-4xrh-5m3m-328w · Published 31/08/2026 · updated 08/10/2026

Package	Affected versions	Patched versions
@hulumi/policies npm	`< 1.3.2`	`1.3.2`

Description

Impact: @hulumi/policies versions before 1.3.2 did not fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail, so some admin-equivalent policy paths could pass policy evaluation.

Patched in 1.3.2: the validator inspects the affected policy shapes and includes regression tests.

Remediation: upgrade @hulumi/policies to 1.3.2 or later.

NVD description

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free